TLS mutual authentication client hostname verification

Question

What is the purpose of server-side verification of the client hostname in a mutually authenticated TLS connections? How important is this?

Answer 1

The exact verification done with client certificates depends on the use case. For example in SIP (voice over IP) it is common that the same same system can be both client (initiating a call) and server (accepting a call). In this cases it is common that the same certificate is used as client and server certificate and that it contains the hostname of the SIP device. But with HTTPS it is more common that the client certificate contains an email or other user specific identify and no hostname at all.

If the subject of the certificate should be verified or not depends on the use case too. In some cases the server knows which subject to expect and can verify that the certificate matches the expectation. But for example in HTTPS the server typically only knows that it expects a certificate issued by a specific CA (and verifies this expectation) and then simply assumes the user information in the certificates subject are correct (since the CA is trusted to put the right information there) and uses the extracted user information to determine which user has been connected, i.e. instead of giving the username in a login prompt.